101 commands
Network CLI command reference
Every router, switch, and host command NetForge-AI actually runs — with real syntax, a copy-paste example, and the gotcha that trips people up. Unlike a static cheat-sheet, each command is one click from a live simulator, so you can type it and watch the network react.
Navigation
- enableEnter privileged exec mode (R1> → R1#). Required before any 'show' or 'configure' command.
- disableReturn to user-exec mode (R1# → R1>).
- configure terminalEnter global configuration mode. Aliased as 'conf t'.
- exitStep out of the current submode (iface → config → enable → user).
- endJump straight from any config submode back to privileged exec (R1#). Shortcut: Ctrl+Z.
- do <command>Run a privileged-exec command from inside config mode without exiting.
Show & diagnostics
- show running-configPrint the active configuration. Use 'show run | include ospf' to filter.
- show startup-configPrint the saved (NVRAM) config. Empty until you run 'write' or 'copy run start'.
- show ip interface briefOne-line per interface: IP, admin status, line protocol. The single most useful verification command.
- show interfaces [iface]Detailed counters and status for one or all interfaces (MAC, bandwidth, duplex, errors).
- show interfaces statusSwitch port summary: connected / notconnect / disabled, plus access VLAN and speed.
- show interfaces switchportPer-port L2 details: administrative mode, operational mode, access VLAN, native VLAN, allowed VLANs.
- show vlan briefVLAN database with ports assigned to each. Trunks don't appear here — they carry every VLAN.
- show mac address-tableL2 forwarding table: MAC → port mapping the switch learned from frames.
- show ip routeRouting table. Codes: C=connected, S=static, O=OSPF, R=RIP, D=EIGRP. Default route shown last with *.
- show ip route <protocol>Filter the route table by protocol: ospf, eigrp, rip, static, connected.
- show ip ospf neighborOSPF adjacency table — every router we've reached Full state with.
- show ip ospf interfacePer-interface OSPF state: area, cost, hello/dead timers, passive flag.
- show ip eigrp neighborsEIGRP adjacency table for the current AS.
- show ip protocolsSummary of every dynamic-routing process configured on this router.
- show arpARP cache: IP → MAC mappings learned from ping/data traffic.
- show cdp neighbors [detail]List directly-connected neighbours discovered via CDP. 'detail' adds their IP and platform.
- show lldp neighbors [detail]Same as CDP but uses LLDP (IEEE 802.1AB) — works across vendors.
- show spanning-treeSTP state: root bridge, port roles, port states.
- show ip dhcp bindingActive DHCP leases this router has handed out.
- show versionHardware model, OS version, uptime, interface counts.
Basic config
- hostname <name>Rename the device. The prompt updates immediately.
- enable secret <password>Set the encrypted password required to enter privileged mode.
- banner motd <delim>text<delim>Message-of-the-day shown to anyone connecting. Delim character marks start and end.
- ip domain-name <name>Domain suffix for the device (also required before 'crypto key generate rsa' for SSH).
- service password-encryptionHash all clear-text passwords in running-config (Type 7).
- username <user> [privilege N] secret <pwd>Local user account for AAA/SSH/console login.
Interface
- interface <id>Enter interface config mode for one port. Names: Gi0/0, Fa0/1, Se0/0/0, Vlan10, Gi0/0.10, Loopback0.
- ip address <ip> <mask>Assign an IPv4 address. Use dotted-decimal mask, not prefix length.
- ip address dhcpAcquire the address via DHCP rather than hard-coding it.
- no shutdownAdministratively enable the interface. Required after configuring a router port.
- shutdownAdministratively disable the interface (admin-down).
- description <text>Free-form label for the port, visible in 'show interfaces description'.
- interface Loopback <N>Create a virtual interface that's always up — perfect for stable router-IDs.
- interface <iface>.<sub>Create a subinterface for router-on-a-stick (inter-VLAN routing).
- encapsulation dot1Q <vlan>Tag the subinterface with this VLAN ID. Must match the trunk's allowed VLAN.
Switching (VLAN/STP)
- vlan <id>Create or enter a VLAN. Range 1-4094. VLAN 1 is the default.
- switchport mode accessLock the port into access mode — carries one untagged VLAN. For end-host ports.
- switchport access vlan <id>Place the access port in the given VLAN.
- switchport mode trunkSet the port to trunk — carries 802.1Q-tagged frames for multiple VLANs. For switch-switch / switch-router links.
- switchport trunk allowed vlan <list>Limit which VLANs traverse the trunk. Use 'add'/'remove' to modify.
- switchport trunk native vlan <id>Native VLAN — frames in it cross the trunk untagged. Must match on both sides.
- interface vlan <id>Create an SVI — the L3 interface for that VLAN. Lets a multilayer switch route between VLANs.
- spanning-tree portfastSkip listening/learning on this port — only safe for end-host ports.
- spanning-tree bpduguard enableShut the port down if it receives a BPDU — protects PortFast ports.
- spanning-tree mode rapid-pvstUse Rapid-PVST+ (fast STP per VLAN). Default since 2003.
Routing
- ip route <network> <mask> <next-hop>Add a static route. Supports next-hop IP or exit-interface, optional AD.
- ip route 0.0.0.0 0.0.0.0 <next-hop>Default route — sends anything not matched elsewhere out to the next hop.
- router ospf <pid>Enter OSPF process configuration. PID is locally significant — does NOT need to match peers.
- network <ip> <wildcard> area <id>Enable OSPF on every interface whose IP matches. Wildcard = inverted mask.
- router-id <a.b.c.d>Hard-code OSPF router ID. Else router picks highest loopback or active interface IP.
- passive-interface <iface>Send no Hellos out this interface (still advertises the subnet). Use on user-facing ports.
- router eigrp <AS>Enter EIGRP process for the given autonomous system. AS must match between neighbors.
- router ripEnter RIP process config. Then 'network <classful-net>' enables RIP on matching interfaces.
- ip default-gateway <ip>Set the gateway on a non-routing device (L2 switch, endpoint).
Services
- ip dhcp pool <name>Create a DHCP pool. Inside the pool define network, default-router, dns-server, etc.
- ip dhcp excluded-address <start> [end]Reserve addresses (typically the gateway and server IPs) so DHCP won't hand them out.
- ip helper-address <server>Relay DHCP broadcasts arriving on this interface to a DHCP server in another subnet.
- ip nat inside / outsideTag the interface as the inside (private) or outside (public) side of NAT.
- ip nat inside source list <acl> interface <iface> overloadPAT — many private hosts share one public IP (the outside interface).
- ntp server <ip>Sync the device clock to an NTP server.
Security
- access-list <10-99> {permit|deny} <src> <wild>Numbered standard ACL — matches source IP only. Final implicit deny.
- ip access-list extended <name>Named extended ACL — matches src + dst + protocol + ports. Modern preferred form.
- ip access-group <acl> in|outApply an ACL to inbound or outbound traffic on this interface.
- switchport port-securityEnable port-security to limit which/how many MACs can use the port.
- switchport port-security maximum <n>Allow at most N MAC addresses on this port.
- switchport port-security violation {shutdown|restrict|protect}What to do when an unauthorised MAC appears. Shutdown is default and most secure.
- line vty 0 4Configure the five VTY (telnet/SSH) lines.
- transport input sshAllow only SSH (not telnet) on the VTY lines.
- login localAuthenticate VTY/console users against the local 'username' database.
- crypto key generate rsaCreate the RSA key pair SSH needs. Requires 'ip domain-name' first.
Lifecycle
Connectivity tests
Endpoint shell
- ipconfig [/all]Windows-style adapter info. '/all' adds MAC, DHCP, DNS.
- ifconfigLinux-style adapter info — flags, addresses, MAC.
- ip aModern Linux address listing. Shows NO-CARRIER when the cable isn't plugged in.
- ip routeLinux routing table. Connected subnets only appear for interfaces with carrier.
- ip neighLinux ARP cache equivalent.
- arp -aShow ARP cache. Empty until you run a ping that resolves a MAC.
- route printWindows-style route table.
- tracert <ip>Windows traceroute.
- mtr <ip>Continuous traceroute (Linux). Same effect as tracert in the simulator.
- arping <ip>Single ARP probe — verifies L2 reachability without ICMP.
- ethtool <iface>Show NIC capabilities and 'Link detected' (real carrier status).
- dig <name>DNS lookup. Returns NXDOMAIN unless the simulator has a host registered.
- nslookup <name>DNS lookup (Windows-flavoured output).
- ssModern netstat — listening sockets and connections. '-i' for interface stats.
- netstat -rSame as 'route -n' — kernel route table.
- dhclientRenew the DHCP lease. Triggers a full DORA exchange visible in the capture tab.
- hostname [new]Show or set the host name.
- cat /etc/resolv.confShow DNS resolver configuration.
- uname -aKernel and host info — the simulator reports NetForge Linux.
- clear / clsWipe the terminal transcript.